Security advice, made clearer

A published advisory describes a permissions issue in Secure Custom Fields. It affects how certain custom-field rules are applied when a post is saved, but an affected version is not evidence that a site has been compromised.

A published notice describes an access-control issue in the Secure Custom Fields WordPress plugin. Here is what site owners should check and what the notice does—and does not—tell us.

A published security notice concerns the WordPress plugin Secure Custom Fields. It relates to access checks around unpublished posts, so site owners should check their installed software and the publisher’s current guidance.

A vulnerability has been reported in the Secure Custom Fields WordPress plugin. The published evidence describes a stored script risk for sites using affected versions, but it does not show that any particular website has been compromised.

A published security notice says unauthenticated visitors may be able to read messages submitted through bundled forms in affected versions of two Pronamic Pay plugins.

A MariaDB server weakness could allow a specially authorised database account to gain higher privileges. Here is how to check your setup calmly and safely.

A published security issue affects certain MariaDB server releases. It depends on a particular database permission and account setup, so checking the installed software version is the sensible first step.

A vulnerability in MariaDB server concerns how binary FRM metadata is validated. The published evidence describes a possible route to a crash or code execution when a specially crafted file is placed in the database data directory.

A high-severity MariaDB security issue could affect certain database installations. Here is what to check, and how to approach an update safely.

A flaw in MariaDB’s handling of imported MySQL tables could expose information or crash a database server. Check the affected-versions table and the publisher’s remediation guidance.

A medium-severity authorisation issue could allow an unauthenticated visitor to view unpublished job-position details in affected Dolibarr installations. Here is what site owners should check.

A reported vulnerability affects Dolibarr ERP CRM versions before 24.0.0. It requires administrator authentication, but could allow operating-system commands to be run as the web server user.

A vulnerability in certain versions of the open-source Python PDF libraries pypdf and pypdf2 could make processing a specially crafted PDF keep running indefinitely. Here is how to check what your website uses and what to do next.

A published security issue in OpenEMR could let an authenticated user access and change billing information belonging to other patient encounters. Here is how to assess the practical risk without assuming that any particular installation has been compromised.

A reported authorisation flaw in OpenEMR could let a logged-in, low-privilege user read or change confidential patient billing notes. Check the affected-versions table and the publisher’s current guidance before making changes.

A reported stored cross-site scripting issue affects OpenEMR installations in the releases shown in the affected-versions table. Here is what the finding means and what administrators can do next.

A reported vulnerability in OpenEMR could allow an authenticated attacker to run uploaded PHP code in some circumstances. Here is how to assess your installation safely.

A reported high-severity issue in OpenEMR could let authenticated, low-privilege users view or alter other patients’ prior-authorisation records. Here is what organisations should check.